Threat Assessment Warning Signs: Lessons from New Research

A new study by Jason Silva and Adam Lankford offers a useful reminder for anyone working in behavioral threat assessment: people planning serious violence often communicate something about their intentions before an attack. The challenge is not simply identifying warning signs. It is making sure those signs are noticed, reported, connected, and assessed.

The researchers reviewed 483 U.S. mass shootings occurring between 2000 and 2023. They examined leakage, direct threats, public reporting, and how the criminal justice system responded. Overall, 41% of the shootings were preceded by some form of leakage or threat. Among public mass shootings, that number increased dramatically to 71%.

For threat assessment teams, several practical lessons stand out.

Leakage matters

Leakage occurs when someone communicates violent intentions to a third party rather than directly threatening the eventual target. It might be a conversation with a friend, a text message, a drawing, an online post, or a comment to a coworker.

Threat assessment professionals have long understood that leakage can provide an opportunity for intervention. This study reinforces that point. Violent intent may surface in many different places and through many different people.  This means teams should avoid focusing only on statements that meet a narrow definition of a "threat."

A student saying, "I'm going to kill my professor," deserves attention. But so does a student telling a roommate, "Someday everyone here is going to remember my name."

The second statement may be less direct, but it can still be important when considered alongside other behaviors.

The biggest gap may occur before the team ever hears about the concern

Among shootings where leakage or threats occurred, only 54% were reported before the attack. That means roughly 46% went unreported. When reports were made, however, the study found that 83% resulted in some type of criminal justice response. That finding has major implications for schools, colleges, workplaces, and communities.

A sophisticated threat assessment process accomplishes very little if people do not know when or how to report concerns.

Organizations should continually ask: Would the average student, employee, parent, roommate, or coworker know what to report and where to report it?

Reporting systems should be easy to find, easy to use, and clearly explained.

People hesitate because they are unsure

One of the most interesting findings involves why people may fail to report. The researchers suggest that uncertainty about dangerousness may be a bigger obstacle than fear of retaliation. People were more likely to report situations containing clearer signals, such as direct threats, specific discussion of mass violence, communication across multiple platforms, or concerning statements made to multiple people.  This is an important training lesson.

We should stop asking community members to decide whether the person is dangerous. That is the threat assessment team's job.

Instead, encourage people to ask: "Is this behavior concerning enough that someone should know about it?"

Reporting is not the same thing as accusing someone of being dangerous. It simply puts information in the hands of people trained to evaluate it.

A comment may be only one piece of a larger puzzle

Reporting increased when concerning communications appeared through multiple modes or were shared with multiple people. This reinforces a basic principle of behavioral threat assessment: information should be aggregated.

• A professor may hear one troubling statement.

• A roommate may know about a recent grievance.

• Campus police may know about an earlier confrontation.

• A counseling professional may know about increasing desperation.

• A conduct office may know about escalating conflicts.

None of these pieces alone necessarily establishes elevated risk. Put together, however, they may reveal a very different pattern. Threat assessment teams exist partly to assemble that mosaic.

Don't dismiss concerning statements as "attention-seeking"

Another practical lesson involves statements that appear designed to provoke reactions. It is tempting to dismiss disturbing comments as:

• "They're just trying to get attention."

• "They say things like that all the time."

• "It's probably a joke."

• "They're just venting."

The study discusses attention-seeking as one possible explanation for leakage. But attention-seeking and risk are not mutually exclusive. In some cases, seeking attention may actually be part of the pathway through which violent intentions become visible. 

The better question is not whether the individual "really meant it." The better question is: "What does this communication tell us about the person's thinking, circumstances, grievances, intentions, capabilities, and trajectory?"

Context matters more than any single risk factor

The researchers found associations between leakage or threats and several characteristics, including prior arrest, domestic violence, suicidal ideation, mental health concerns, fame-seeking, and ideological motives. Those findings should not be turned into a checklist predicting violence.

The authors specifically caution that their study identifies associations, not causation. They also note limitations related to relying on publicly available information and studying completed attacks rather than prevented cases. Threat assessment remains a contextual process. Mental illness alone does not predict targeted violence. Neither does ideology, anger, unusual language, grievance, or a criminal history.

The task is to understand how behaviors interact and whether someone appears to be moving toward violence.

Teach people to report uncertainty

Perhaps the simplest prevention message from this research is that you don't have to be certain to report a concern.

The authors recommend educating the public about leakage and threats, encouraging reporting even when someone is uncertain about the risk, making reporting easier and potentially anonymous, and increasing confidence that reports will be handled fairly and appropriately. 

For colleges, schools, and workplaces, that means creating a reporting culture where people are comfortable saying: "I don't know what this means, but I thought someone should know." That sentence may be one of the most useful tools in violence prevention.

The Bottom Line

The study does not suggest that every angry statement predicts violence. Most do not. Instead, it reinforces something central to modern behavioral threat assessment: serious violence is often preceded by observable behavior, communication, or changes that create opportunities for intervention. The challenge is building systems capable of capturing those signals.

Good threat assessment therefore requires more than a skilled team. It requires a community that knows what to notice, feels comfortable reporting uncertainty, and trusts that someone will thoughtfully assess what happens next.

The goal is not to predict the future from a single red flag. It is to notice when pieces begin forming a pattern and intervene while there is still time.